PA vnet/subnet question

[Dash_Brousseau]

I'm trying to create a PA to handle a few internet facing DMZ zones and also to be the default route when a app needs to go outside

So it would have untrust/trust/mgmt and a few dmz L3 interfaces

So it seems I have 2 options for deployments

One big vnet  for the PA

Carved subnets would be the PA L3 interfaces

Also the carved subnets, applications would in them

DMZ-Web /24

DMZ-FTP /24

etc etc

But i was told that's not a good design but it works.

Or vnet for the PA

Small carved subnets for each PA L3 interfaces

However the application be would in a separate vnet all together

However I would lose all the zones for each subnet I'm accustom to for firewall rules